Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

ab767277d6...aa.exe

windows7-x64

10

ab767277d6...aa.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    177s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 09:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ab767277d6fc585aaa48855a3c7431998bcb3b057e98b41adae43894e1204aaa.exe

  • Size

    127KB

  • MD5

    40e688d7aa46c49bc8d6fb7a2dfcd2d9

  • SHA1

    22347d37e9fbfb269c7a437d4371416830271b6a

  • SHA256

    ab767277d6fc585aaa48855a3c7431998bcb3b057e98b41adae43894e1204aaa

  • SHA512

    f513eda2eaed2ea6aa41d8938afaf1e0f33a0c5330d2e29a2de6c405acb193022effd489583d31c8e5164234447767af25ee03c79d6bfaffa2d2a7ca3b0a2d57

  • SSDEEP

    3072:7nSueiCRC1sVAPtvc/7mlFmyj6fkVl4si:7A5Sespc/wFmfcq

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://64.85.233.8/js/gate.php

http://tsd2.ddns.me/js/gate.php
Attributes
  • payload_url

    http://64.85.233.8/js/po.exe

    http://tsd2.ddns.me/js/po.exe

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab767277d6fc585aaa48855a3c7431998bcb3b057e98b41adae43894e1204aaa.exe
    "C:\Users\Admin\AppData\Local\Temp\ab767277d6fc585aaa48855a3c7431998bcb3b057e98b41adae43894e1204aaa.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Users\Admin\AppData\Local\Temp\ab767277d6fc585aaa48855a3c7431998bcb3b057e98b41adae43894e1204aaa.exe
      "C:\Users\Admin\AppData\Local\Temp\ab767277d6fc585aaa48855a3c7431998bcb3b057e98b41adae43894e1204aaa.exe"
      2⤵
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • outlook_win_path
      PID:4508

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2212-132-0x0000000010000000-0x000000001001B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2212-136-0x0000000010000000-0x000000001001B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/4508-135-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download

  • memory/4508-138-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download

  • memory/4508-139-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download

  • memory/4508-140-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download

  • memory/4508-141-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download